Some issues with the Interface Statistics Block

[guyharris]

Issue 1:

The ISB has a time stamp, but it just says that it's the "time this statistics refers to", without indicating in what way a set of statistics refers to a particular time.

I suspect the intent was "the time as of which these values were current", i.e. that a program writing a capture would fetch statistics it hasn't been maintaining itself and would then write out an ISB with the current date/time as the time stamp.

Issue 2:

There are options in the ISB for the capture start and end time. If you have an ISB with a capture start and end time, followed by more packet blocks, what does that mean? If there are more packets, obviously either 1) the capture hasn't stopped on the interface in question or 2) somebody added more packets to the end.

We might want to indicate that only an ISB that follows all packet blocks for the interface in question should have the end time specified - and that, if you write out ISBs before the capture stops on that interface, if any of them have a capture start time, all the capture start time values should be the same for that interface.